Previous efforts to monitor network traffic have focused on the optimal deployment of monitoring infrastructure in operational networks for accurate and efficient measurement of network traffic. Such deployment involves both monitoring infrastructure placement as well as configuration decisions. An example of the former includes choosing the interfaces at which to install monitoring equipment, e.g., DAG® cards, and the latter includes tuning the sampling rate and sampling scheme used by the monitoring equipment. The optimal placement and configuration of monitoring infrastructure for a specific measurement objective typically assumes prior knowledge of the traffic characteristics. However, traffic characteristics and measurement objectives may evolve dynamically, potentially rendering a previously determined solution suboptimal.
In a simple scenario, certain routing devices in the network implement uniform sampling or an approximation of it. Alternatively, a network may implement heterogeneous sampling algorithms, each optimized for certain kinds of traffic subpopulations. For instance, some routing devices can implement sophisticated algorithms to give accurate flow-size estimates of medium-sized flows that otherwise would not have been captured by uniform sampling. A network can have different active and passive measurement infrastructure and algorithms deployed, and some paths through the network may have greater measurement potential than others.